Legally speaking, patients are "implied" to have consented to their medical records being shared if it was shared for the purpose of "direct care."

But Caldicott, the UK's health data regulator, wrote in her letter: "When I wrote to you in December, I said that I did not believe that when the patient data was shared with Google DeepMind, implied consent for direct care was an appropriate legal basis."

Caldicott, who does not dispute the app's ability to help clinicians save lives today, added: "Given that Streams was going through testing and therefore could not be relied upon for patient care, any role the application may have played in supporting the provision of direct care would have been limited and secondary to the purpose of the data transfer.

"My considered opinion therefore remains that it would not have been within this reasonable expectation of patients that their records would have been shared for this purpose."

A spokesperson for the National Data Guardian confirmed to Business Insider that the letter is real.

Privacy campaign group medConfidential said in a statement: "Google's lawyers are expensive, but 'inappropriate legal basis' is still a euphemism for unlawful."

The Streams app.
Google DeepMind

The National Data Guardian, which was set up to help ensure that citizens' confidential medical information is safeguarded securely and used properly, explained at the end of the letter that she would be passing on her views to the Information Commissioner, Elizabeth Denham, who is the data protection officer of the UK.

The Information Commissioner's Office is carrying out its own investigation into whether the data transfer between from Royal Free to DeepMind was legal under the Data Protection Act. A verdict is expected to be made public in the coming weeks.

Streams is a clinical app designed to help clinicians identify and treat patients as quickly as possible. It pulls together patient information and generates an automatic alert when a problem is detected. It does not make use of DeepMind's AI or machine learning technologies.

DeepMind cofounder Mustafa Suleyman.
Google DeepMind
Following the initial testing period, the Royal Free rolled out the Streams app to a number of clinicians in its hospitals as part of a subsequent deal, which is not being investigated.

Dominic King, the clinical lead at Google DeepMind, told Sky News: "It's really important to say that DeepMind is a British company, and although acquired by Google, operates independently. At no point has any patient data been shared with other Google products or services, or used for commercial purposes.

"I think one thing that we do recognise that we could have done better is make sure that the public are really informed about how their data is used."

A spokesperson for DeepMind Health sent Business Insider the following statement:

"Nurses and doctors have told us that Streams is already speeding up urgent care at the Royal Free and saving hours every day. The data used to provide the app has always been strictly controlled by the Royal Free and has never been used for commercial purposes or combined with Google products, services or ads — and never will be.

"Clinicians at the Royal Free put patient safety first by testing Streams with the full set of data before using it to treat patients. Safety testing is essential across the NHS, and no hospital would turn a new service live without testing it first. We're glad the NDG has said that further guidance would be useful to organisations which are undertaking work to test new technologies.

"We also recognise that there needs to be much more public engagement and discussion about new technology in the NHS. We want to become one of the most transparent companies working in NHS IT, appointing a panel of Independent Reviewers, embarking on a major patient involvement strategy, and starting a groundbreaking project called Verifiable Data Audit. We believe that these steps are helping to set a new standard of transparency across the health system."

Google DeepMind's first deal with Royal Free London was torn apart in an academic paper published in March. The "Google DeepMind and healthcare in an age of algorithms" paper— coauthored by Cambridge University's Julia Powles and The Economist's Hal Hodson — questioned why DeepMind was given permission to process millions of NHS patient records so easily and without patient approval. It concluded that the deal was riddled with "inexcusable" mistakes.

A spokesperson for the Royal Free London sent the following statement to Business Insider:

"The Streams app was built in close collaboration with clinicians to help prevent unnecessary deaths by alerting them to patients in need in a matter of seconds. It is now in use at the Royal Free, and is helping clinicians provide better, faster care to our patients. Nurses report that it is saving them hours each day.

"We took a safety-first approach in testing Streams using real data. This was to check that the app was presenting patient information accurately and safely before being deployed in a live patient setting. Real patient data is routinely used in the NHS to check new systems are working properly before turning them fully live. No responsible hospital would ever deploy a system that hadn't been thoroughly tested. The NHS remained in full control of all patient data throughout.

"This project, designed to help prevent unnecessary deaths using new technology, is one of the first of its kind in the NHS and there are always lessons we can learn from pioneering work. We take seriously the conclusions of the NDG, and are pleased that they have asked the Department of Health to look closely at the regulatory framework and guidance provided to organisations taking forward this type of innovation, which is essential to the future of the NHS.

"We are proud of the work we have done with DeepMind and will continue to be bold and brave for the benefit of our patients."

A spokesperson for the National Data Guardian for Health and Care (NDG) told Business Insider:

"Dame Fiona Caldicott, and her panel of advisors have been considering how patient data was shared by the Royal Free London NHS Foundation Trust with DeepMind under the 'Streams' project to improve the detection and management of acute kidney failure. In discussions with the ICO about this, the NDG agreed to provide advice on the use of implied consent for direct care as a legal basis for the sharing of data by the Royal Free with DeepMind. While the ICO investigation is ongoing the NDG will provide any further assistance to the ICO as required, but will not be commenting further on the matter at this point."